From 56ab46e62897a2a31b871f06a478513f83d4e90a Mon Sep 17 00:00:00 2001 From: Steven Lamphear Date: Wed, 6 May 2026 15:35:48 -0500 Subject: [PATCH] linux-postmarketos-allwinner: fix rtl8723cs CFI panic on PinePhone The rtl8723cs staging driver in megi's tree [declares rtw_xmit_entry as returning int](https://codeberg.org/megi/linux/src/tag/orange-pi-6.18-20260105-0049/drivers/staging/rtl8723cs/os_dep/linux/xmit_linux.c#L513), but the kernel core's net_device_ops::ndo_start_xmit [expects netdev_tx_t](https://codeberg.org/megi/linux/src/commit/6519f78239276e5d14698135fe05aa3206947ab9/include/linux/netdevice.h#L1413). With kCFI enabled on aarch64 the indirect call from dev_hard_start_xmit traps on the type-hash mismatch, panicking the kernel as soon as wpa_supplicant sends a frame. This patch changes rtw_xmit_entry's return type to netdev_tx_t (the function already returns 0, which is NETDEV_TX_OK). Tested on a PinePhone 1.2 with both an SD-card install and an eMMC install: wifi associates and remains stable, no CFI panic. The eMMC install had previously been connected to wifi, so it froze during boot; the SD-card install was new, but would freeze (and eventually crash) upon attempting to connect to wifi. Closes: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/work_items/4507 Part-of: --- ...cs-fix-CFI-signature-of-rtw_xmit_ent.patch | 67 +++++++++++++++++++ .../linux-postmarketos-allwinner/APKBUILD | 4 +- 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 device/community/linux-postmarketos-allwinner/0012-staging-rtl8723cs-fix-CFI-signature-of-rtw_xmit_ent.patch diff --git a/device/community/linux-postmarketos-allwinner/0012-staging-rtl8723cs-fix-CFI-signature-of-rtw_xmit_ent.patch b/device/community/linux-postmarketos-allwinner/0012-staging-rtl8723cs-fix-CFI-signature-of-rtw_xmit_ent.patch new file mode 100644 index 000000000..81e29e4cd --- /dev/null +++ b/device/community/linux-postmarketos-allwinner/0012-staging-rtl8723cs-fix-CFI-signature-of-rtw_xmit_ent.patch @@ -0,0 +1,67 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Steven Lamphear +Date: Wed, 6 May 2026 00:00:00 +0000 +Subject: [PATCH] staging: rtl8723cs: fix CFI signature of rtw_xmit_entry + +rtw_xmit_entry is assigned to net_device_ops::ndo_start_xmit, whose +expected signature is + + netdev_tx_t (*)(struct sk_buff *, struct net_device *) + +but the staging driver declares it returning int. After typedef +expansion the parameter types already match (_pkt is struct sk_buff +and _nic_hdl is struct net_device *), so the only mismatch is the +return type. + +With kCFI enabled on arm64, the indirect call from dev_hard_start_xmit +hashes the expected target type and traps when it does not match, +producing a fatal panic on the PinePhone as soon as wpa_supplicant +sends a frame: + + CFI failure at dev_hard_start_xmit+0xdc/0x250 + (target: rtw_xmit_entry+0x0/0xd4 [8723cs]; + expected type: 0xc4815b0f) + Kernel panic - not syncing: Oops - CFI: Fatal exception in interrupt + +Change the return type of rtw_xmit_entry (and its forward declaration +in the PLATFORM_LINUX block of xmit_osdep.h) to netdev_tx_t so the +CFI type hash matches, and update the local `ret` variable to use +netdev_tx_t / NETDEV_TX_OK to match. + +Link: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/work_items/4507 +--- + drivers/staging/rtl8723cs/include/xmit_osdep.h | 2 +- + drivers/staging/rtl8723cs/os_dep/linux/xmit_linux.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/rtl8723cs/include/xmit_osdep.h b/drivers/staging/rtl8723cs/include/xmit_osdep.h +--- a/drivers/staging/rtl8723cs/include/xmit_osdep.h ++++ b/drivers/staging/rtl8723cs/include/xmit_osdep.h +@@ -68,7 +68,7 @@ + struct xmit_buf; + + extern int _rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev); +-extern int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev); ++extern netdev_tx_t rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev); + + #endif /* PLATFORM_LINUX */ + +diff --git a/drivers/staging/rtl8723cs/os_dep/linux/xmit_linux.c b/drivers/staging/rtl8723cs/os_dep/linux/xmit_linux.c +--- a/drivers/staging/rtl8723cs/os_dep/linux/xmit_linux.c ++++ b/drivers/staging/rtl8723cs/os_dep/linux/xmit_linux.c +@@ -510,11 +510,11 @@ + } + #endif + +-int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev) ++netdev_tx_t rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev) + { + _adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev); + struct mlme_priv *pmlmepriv = &(padapter->mlmepriv); +- int ret = 0; ++ netdev_tx_t ret = NETDEV_TX_OK; + + if (pkt) { + #ifdef CONFIG_CUSTOMER_ALIBABA_GENERAL +-- +2.45.0 diff --git a/device/community/linux-postmarketos-allwinner/APKBUILD b/device/community/linux-postmarketos-allwinner/APKBUILD index 85dd6509d..f6edfae52 100644 --- a/device/community/linux-postmarketos-allwinner/APKBUILD +++ b/device/community/linux-postmarketos-allwinner/APKBUILD @@ -4,7 +4,7 @@ _flavor=postmarketos-allwinner _config="config-$_flavor.$CARCH" pkgname=linux-$_flavor pkgver=6.18.3_git20260105 -pkgrel=2 +pkgrel=3 _tag="orange-pi-6.18-20260105-0049" pkgdesc="Kernel fork with Pine64 patches (megi's tree, slightly patched)" arch="aarch64 armv7" @@ -46,6 +46,7 @@ source="$pkgname-$_tag.tar.gz::https://codeberg.org/megi/linux/archive/$_tag.tar 0009-ARM-dts-sun6i-Add-Lark-FreeMe-70.2S-tablet.patch 0010-eMMC-workaround.patch 0011-arm64-dts-allwinner-orangepi-3-fix-ethernet.patch + 0012-staging-rtl8723cs-fix-CFI-signature-of-rtw_xmit_ent.patch " builddir="$srcdir/linux" @@ -97,4 +98,5 @@ eaff5d1167e2fa1a46619dc15623d1ac979a76f67b385d43cc026150efeb98dd46ab3e824e1bcf24 38517de7f29e1769060cbcd297b116db71f2dc0da5f51a44d9c62266d2e43d0ed9f006de59d8dad2118fdac66cccd603d8f4df926602581523bf288106e46c87 0009-ARM-dts-sun6i-Add-Lark-FreeMe-70.2S-tablet.patch 295079325f9bd30d2ccaebcc02f618faf6c6ab671499168a359c7460743f2ca8b8454495e272d74d781bb3c42a41edcdab49a36c34635ffa4e277670d10b2628 0010-eMMC-workaround.patch f0fa032dcd25f4b3f5cbbd863d7580f786d34bb6111bfcea8eaa0bdb8e40bba7baa4c32fbbc20ea90bf575f6804c01bc0e6e892ad8547ff7242e07b3128ab929 0011-arm64-dts-allwinner-orangepi-3-fix-ethernet.patch +28c32c65fd51146b56e381720a5056708b0ff002cebbcab7b0013009c2a05cc0411244c868e1a2d8dfbd9bfd186611a9caf88851768596d74f9c3b1a4ab2fbf2 0012-staging-rtl8723cs-fix-CFI-signature-of-rtw_xmit_ent.patch "